PatchTheCVECVE-2026-19681: An authenticated command injection vulnerability exists in Security Center related to file upload processing
CVE-2026-19681 is a critical-severity flaw (CVSS 9.9) affecting security center. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Why this priority
- Critical severity
- EPSS top 9%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.9 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 4.2% (top 9%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-08-14 |
| Last modified | 2026-08-19 |
Last updated 2026-08-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: h00die/POC-CVE-2026-19681 (0 stars)
- Metasploit: Tenable Security Center SCAP Audit File Command Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-19681?
security center: upgrade to 6.9.0. Exact commands for each OS are on this page.
Is CVE-2026-19681 being exploited?
CVE-2026-19681 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-19681 affect?
CVE-2026-19681 affects security center. Severity is critical (CVSS 9.9). An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution o
How urgent is CVE-2026-19681?
Priority 62/100. Critical severity; EPSS top 9%: very likely to be exploited; Public exploit reference
Related CVEs
- CVE-2026-64879 CRITICAL 9.9 UPGRADE A filename supplied during file upload is not properly sanitized before being used in system command execution
- CVE-2026-64881 HIGH 8.8 UPGRADE The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system c
- CVE-2026-64878 CRITICAL 9.9 UPGRADE Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling,
- CVE-2026-64877 HIGH 8.4 UPGRADE An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive
- CVE-2026-64880 HIGH 7.1 UPGRADE Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries witho